Setting Up AWS PrivateLink for RDS-EKS Interaction
Overview:
This guide provides a walkthrough for configuring AWS PrivateLink to facilitate secure, private communication between an RDS (Amazon Relational Database Service) instance and an EKS (Amazon Elastic Kubernetes Service) cluster located in different regions. AWS PrivateLink allows for this interaction without the need for VPC peering, provided both services reside within the same AWS account.
The process involves creating two VPC (Virtual Private Cloud) endpoints: one in the RDS instance's region and another in the EKS cluster's region. These endpoints serve as intermediaries, enabling private connectivity between the RDS and EKS services.
While VPC peering isn't necessary for cross-region connectivity within the same AWS account, it becomes essential when the RDS and EKS are in different AWS accounts. Additionally, regardless of the account setup, a valid peering or VPN connection between the VPCs is crucial to ensure seamless traffic flow between the endpoints across different regions.
Configuration Steps
Using AWS Console
To establish a private link between different VPCs for accessing resources such as an EKS cluster and an RDS instance via the AWS Management Console, follow these steps:
Open the AWS Management Console and navigate to the VPC Dashboard. Select the VPC where the EKS cluster is operational.
Click on "Endpoints" in the left-hand menu, then click "Create Endpoint".
From the list of available services, select the service name for EKS and choose "Interface" for the endpoint type.
Select the
VPCand thesubnetwhere you wish to create the endpoint.Choose the
security groupto associate with the endpoint. You can either create a new security group or select an existing one.Review the configuration and click "Create Endpoint" to establish the VPC endpoint for EKS.
Repeat steps 2-6 for the VPC where the RDS instance is operational, selecting the RDS service name instead of EKS.
After creating both VPC endpoints, navigate to the
route tablesof each VPC and add a route for the CIDR block of the service to the VPC endpoint ID.In the security group for the EKS cluster, permit inbound traffic from the security group associated with the VPC endpoint for the RDS instance.
In the
security groupfor the RDS instance, permit inbound traffic from the security group associated with the VPC endpoint for the EKS cluster.Test the connection by connecting to the EKS cluster from one of the pods running on the EKS cluster and RDS instance using their
private IP addresses.
Using AWS CLI
The aforementioned steps can also be executed using the AWS Command Line Interface (CLI). Here's how:
Create a VPC endpoint in the VPC where the EKS cluster is operational:
Create a VPC endpoint in the VPC where the RDS instance is operational:
Modify the route tables in each VPC to direct traffic to the VPC endpoints:
Create a security group for the EKS cluster:
Authorize traffic from the VPC endpoint in the security group for the EKS cluster:
Modify the RDS instance to allow traffic from the security group of the VPC endpoint:
Verify the connection:
Ensure that you can access the EKS cluster and RDS instance using the private IP addresses of the VPC endpoints.
About LightBeam
LightBeam automates Privacy, Security, and AI Governance, so businesses can accelerate their growth in new markets. Leveraging generative AI, LightBeam has rapidly gained customers’ trust by pioneering a unique privacy-centric and automation-first approach to security. Unlike siloed solutions, LightBeam ties together sensitive data cataloging, control, and compliance across structured and unstructured data applications providing 360-visibility, redaction, self-service DSRs, and automated ROPA reporting ensuring ultimate protection against ransomware and accidental exposures while meeting data privacy obligations efficiently. LightBeam is on a mission to create a secure privacy-first world helping customers automate compliance against a patchwork of existing and emerging regulations.
Last updated